The firewall implementation must enforce password encryption for transmission.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37197	SRG-NET-000161-FW-000094	SV-48958r1_rule		Medium

Description
To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The firewall can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the firewall. It is imperative to encrypt passwords before transmitting during any authentication process. This control applies to passwords configured or controlled by the firewall itself.

Description

To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. The firewall can be compromised by personnel with access to the network. Passwords sent in the clear can be intercepted and used by unauthorized personnel to gain administrative access to the firewall. It is imperative to encrypt passwords before transmitting during any authentication process. This control applies to passwords configured or controlled by the firewall itself.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45512r1_chk )
If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the firewall application itself, this is not a finding. View the password configuration or system documentation. Verify the system is configured to encrypt passwords when logging on both locally and non-locally. If passwords are sent in clear text, this is a finding.

Check Text ( C-45512r1_chk )

If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the firewall application itself, this is not a finding.

View the password configuration or system documentation.
Verify the system is configured to encrypt passwords when logging on both locally and non-locally.

If passwords are sent in clear text, this is a finding.

Fix Text (F-42135r1_fix)
Configure the firewall implementation to encrypt passwords prior to transmission as part of the authentication process.